64-bit operating systems
This documentation does not apply to the most recent version of Splunk. Click here for the latest version.
64-bit operating systems
A 64-bit operating system will allow you to increase various settings in Splunk to improve performance.
- Indexing can be improved by increasing the maximum amount of queries that a search will attempt to resolve.
- Index size can be increased in size in 64-bit mode.
indexes.conf
The following are the default values for 32-bit and 64-bit systems:
maxDataSize
The number of MBs db hot is allowed to grow to before it is rolled out to warm. This number should not be increased unless Splunk is running in 64-bit mode.
- 64-bit: 10000
- 32-bit: 750
- 32-bit Windows: 400
maxQueryIds
Note: This setting was removed in 3.4.4.
The maximum number of IDs a search will attempt to resolve in a single query. This is a good value for 32-bit systems. It can be raised for 64-bit installations with large amounts of RAM.
- 32-bit: 10000000
savedsearches.conf
maxResults
The maximum number of results the entire search can generate. NOTE: This is different from the deprecated search command "maxresults" and the maxresults setting in prefs.conf.
- 64-bit: 50000
- 32-bit: 10000
This documentation applies to the following versions of Splunk: 3.3 , 3.3.1 , 3.3.2 , 3.3.3 , 3.3.4 , 3.4 , 3.4.1 , 3.4.2 , 3.4.3 , 3.4.5 , 3.4.6 , 3.4.8 , 3.4.9 , 3.4.10 , 3.4.11 , 3.4.12 , 3.4.13 , 3.4.14 View the Article History for its revisions.